Password Attacks - CompTIA Security+ SY0-701 - 2.4

Main ideas and concepts / lessons

• Credential storage risk (“in the clear”)

  • In some IT systems, an application may store usernames and passwords unencrypted (“in the clear”).
  • This is a major security concern because anyone who gains access to the stored files/databases can immediately obtain plain-text usernames and passwords, enabling rapid account compromise.

• Basic defensive guidance

  • Never store passwords as plain text.
  • If an application stores passwords insecurely, the recommended options are:
    • Stop using the application, and/or
    • Contact the application developer to request a rewrite so passwords can be stored securely.

• Hashing as the secure storage method

  • Instead of storing passwords directly, store passwords as hashes.
  • Hashing concept:
    • Takes a variable-length input (the password) and produces a fixed-length output (the message digest / fingerprint).
    • A small change in input results in a very different hash output (avalanche effect).
    • Hashes cannot realistically be reversed to recover the original password (analogy: fingerprints can’t reconstruct the whole person).

• Illustrative example

  • Example given: using SHA-256.
  • Passwords like 123456 and 1234567 produce very different hashes.
  • In credential storage, you may see usernames, but the stored password field contains only the hash, not the original password.

Attacks discussed and how hashing changes what attackers can do

• Account lockout behavior

  • Many systems lock accounts after a few incorrect attempts (sometimes after a time period, sometimes requiring re-enable).
  • This discourages online guessing.

• Password spraying attack

  • Attack approach:
    • Try common passwords across many accounts, often only a few attempts per account to avoid lockout.
  • Rationale:
    • If an attacker uses the most common passwords (examples mentioned from Wikipedia: formats like 123456, 123456789, qwerty, etc.), they can quickly test likely credentials.
  • How it differs from brute force:
    • Spraying is targeting many accounts with few guesses each.
    • It aims to avoid triggering alarms/lockouts and can work effectively online.

• Brute force attack

  • Generic idea:
    • Try many password candidates until the correct one is found.
    • If accounts lock online, online brute force is slow and limited.

Detailed attacker methodology (brute force process)

• Prerequisite: attacker obtains password hashes

  • The attacker has a file or data containing:
    • Usernames/IDs (e.g., name ID / group ID)
    • The hashed passwords for those accounts
  • The attacker may obtain this hash data via a download or other compromise.
  • The hash alone does not reveal the original password.

• Online brute force (slow)

  • Conceptual steps described:
    • Start with a candidate password (example begins with aaaaa).
    • Compute its hash.
    • Compare the computed hash to the stored hash.
    • If it doesn’t match, move to the next candidate and repeat.
    • Continue until a matching hash is found (example stated: the sought password is literally password).
  • Limitation:
    • Online attempts are slowed because systems may allow only limited tries per day or trigger lockouts.

• Offline brute force (preferred by attackers)

  • Steps described:
    • Copy/download the password-hash file (including usernames/IDs and hashed passwords).
    • Because it’s offline, there’s no account lockout risk.
    • The attacker can try as many guesses as needed given time and computing power.
    • Keep iterating through password candidates and hashing them until a candidate hash matches one stored in the file.

Speakers or sources featured

• Source mentioned: Wikipedia (for the “top five most common passwords” list)
• No individual speakers are explicitly identified in the subtitles.